Security and Vulnerability Disclosure Policy

Last updated: 5 October 2026

Wavertech Ltd. (“Wavertech”, “we”, “us” or “our”) is committed to the security of its products, firmware and online services. We welcome reports of security vulnerabilities and work with security researchers, customers and authorities to identify, validate and remediate issues in a coordinated manner.

1. Scope

This policy applies to:

• WAVER hardware products and WAVER OS firmware and device software;
• our websites: wavertech.com and docs.wavertech.com; and
• cloud services operated by Wavertech, including WAVER+ and PointX CM.

The following are out of scope:

• WAVER devices and networks operated by customers, including device endpoints under w-router.com, unless the device is your own;
• third-party services and integrations, such as payment, messaging and hosting providers, which should be reported to the respective provider; and
• denial-of-service, social engineering and physical attacks (see Section 5).

2. Reporting a Vulnerability

Please report suspected vulnerabilities to:

To help us assess your report, please include as much of the following as possible:

• product name, model and serial number, or the affected URL;
• firmware or software version;
• a description of the vulnerability and its potential impact;
• steps to reproduce; and
• relevant logs, screenshots or a proof of concept.

3. Coordinated Disclosure

When we receive a report, we will:

• acknowledge receipt within five (5) business days;
• investigate and validate the reported issue, and keep you informed of our progress;
• develop and release a fix or mitigation for confirmed vulnerabilities; and
• agree the timing of public disclosure with you, and credit you in the related advisory if you wish.

We aim to remediate confirmed vulnerabilities and coordinate public disclosure within 90 days of the report, depending on severity and complexity. We ask that you do not disclose a vulnerability publicly before a fix or mitigation is available, or before the timing of disclosure has been agreed with us.

4. Safe Harbor

We consider security research conducted in good faith and in accordance with this policy to be authorised, and we will not initiate legal action against researchers who:

• avoid privacy violations, data destruction and service disruption;
• do not access or modify data beyond what is strictly necessary to demonstrate the vulnerability;
• do not exploit a vulnerability for personal or commercial gain;
• test only on devices and accounts they own or are expressly authorised to use; and
• report the vulnerability to us promptly through the channels above.

We cannot authorise testing of devices or networks operated by our customers. Such testing requires the operator’s permission.

5. Prohibited Activities

• denial-of-service attacks or other testing that degrades the availability of our services;
• social engineering or phishing of our employees, partners or customers;
• physical attacks against our facilities or against equipment you do not own;
• accessing, copying or exfiltrating data beyond the minimum necessary to demonstrate a vulnerability; and
• exploiting a vulnerability for personal or commercial gain.

6. Security Updates and Support Period

We address vulnerabilities in our products through firmware and software updates. Security updates are provided free of charge during the support period and are available through the WAVER OS administration panel and our Software Updates page. Customers are responsible for applying security updates in a timely manner.

7. Security Advisories

We publish security advisories for confirmed vulnerabilities on this page, using the identifier format WAVER-SA-YYYY-NNN. Each advisory describes the affected products and versions, the impact, and the available fix or mitigation. Where possible, we also notify administrators, partners and customers whose contact details we hold.

Current advisories are listed at the top of this page.

8. Regulatory Reporting

In accordance with Regulation (EU) 2024/2847 (the Cyber Resilience Act), we notify actively exploited vulnerabilities and severe incidents affecting our products to the competent CSIRT and to ENISA through the Single Reporting Platform, and inform affected users of the issue and of any corrective measures.

9. Counterfeit and Unauthorised Products

This policy applies only to genuine Wavertech and WAVER products. If you discover a vulnerability in a suspected counterfeit, cloned or modified product, please include relevant details in your report so that we can assist with verification.